Game Guardian tutorials - GameCheetah.org

[Enyby]

Game Guardian tutorial – Basics

by Gamecheetah.org · May 25, 2017

 

With this article, Game Guardian tutorial, we will start series of tutorials on topic “how to use Game Guardian”. As you maybe know, Game Guardian is powerful memory scanner and editor used mostly for cheating Android games.
One of the most important things is that Game Guardian runs on x64 and x86 devices, which means that you can use it in emulators (NOX, Bluestacks, Andy, Genymotion, Droid4X…) or various devices, without worrying about compatibility.
It requires Android v.2.3.3(Gingerbread) or newer. Of course, you will need rooted device to do this, so root it before you continue with this step. If you can’t or don’t want to root your phone, you can do it all in emulator, and then transfer your savegame to mobile phone/tablet. Here you can find links for Nox and Bluestacks emulator setup [NOX] [BLUESTACKS].

Before you install this program from the official website,you will need to enable installing apps from unknown sources.
To do that on your device, go to Settings – Security,  and check Unknown sources box.
When you have done this, download Game Guardian from official website [LINK] and install it.

Game Guardian tutorial

When you start Game Guardian, you should see floating icon at the top of you screen. Note that you can move it wherever you want.

Start game that you want to cheat, and click on Game Guardian floating icon. It will automatically show all processes running on your device. Choose the game that you want to cheat.
In this Game Guardian tutorial, we will only do basic memory editing. That means that money/gold/exp value is not encrypted in the memory.

In this article, we will cheat Chuck Norris Nonstop game, as it don’t encrypt anything (we can’t guarantee that Chuck Norris won’t revenge somehow if you do this).

• Click again on Game Guardian, and choose Known (exact) search.
• In value box, input current amount of gold that you have. You will notice equal sign right before the box. That mean that will scan the memory to find all the values that are equal to our value. Now you can leave the equal sign, but in some cases you will have to use other signs.
  “=” in-memory value is the same as the one we put in.
  “!=” in-memory value is NOT the same as the one we put in.
  “<” in-memory value is smaller than the one we put in.
  “>” in-memory value is bigger than the one we put in.

Game Guardian value types

Value types can be different.

1. DWORDs are just simple numbers. Storage size for DWORD type is 4 bytes.
   Example: 1,55, 18999, 123456…
   In other programs, DWORD type can be named 4bytes or LONG.
2. FLOATs are real numbers, numbers with decimal point, 1.23, 3.14 190.5786…
3. DOUBLEs are same as floats, but it can store much larger values (see picture above).
4. WORDs – Same as DWORD, but store much smaller numbers (2 bytes), in programming this type is called INT .
5. BYTEs – Same as DWORD, but only one byte is reserved for the value.
6. QWORDs – Just a bigger number, same as DWORD with bigger storage size.
7. XORs – they are not type of number, it is encryption used in some games.

For reference about data types you can check this article [LINK].
Don’t be confused with all of this. In most cases, you will be searching for DWORD, or the FLOAT/DOUBLE type. If you aren’t confident enough, you can always choose AUTO, and it will scan all the data types (note that this method will be much slower).

Searching for the gold

Now it is time to finally do something. In game, remember the gold amount you have. Open Game Guardian, choose game process (in our case, it will be Chuck Norris Nonstop process).
In upper left corner of the Game Guardian screen, you will see PAUSE icon. Click it to freeze our game (we don’t want gold value to change in the middle of the scan).
.

• Choose Known (exact) search. In value box write amount of gold that you currently have.
• Value type has to be DOUBLE, and value is not encrypted, so don’t check box. In other games, you will probably have to try DWORD value type to find out in which format the value are stored. Click on New Scan.  After scan is completed, wait for gold amount to change.
• For the next step, open Known (exact) search, write the new value, and click on Refine.
  Repeat this step. Earn some gold, then refine the results. Refine search results until you have only two values left.

Editing values in Game Guardian

Editing values is the easiest step once you find the right addresses where they are stored.
Just click on value that you want to change (in previous steps we have found two addresses where the gold is stored), and write in wanted value. Change the number of gold to billions/trillions/quadrillions.

Now close Game Guardian window, and check the game. You should see that gold amount have changed.

This was first tutorial from the Game Guardian tutorial series. Later we will deal with encrypted values, fuzzy search, group and range searches, and speedhack.
Stay tuned.
If you have some suggestions, write in the comments.
For those who want to see how this is done, take a look at the video below.

 

[Enyby]

GameGuardian tutorial – Shadow Fight 2 cheat

by Gamecheetah.org · Published April 5, 2017 · Updated April 6, 2017

Today, we are going to do Shadow Fight 2 cheat with some excellent  piece of software, Game Guardian. It is classic memory scanner/editor, similar with Cheat Engine on PC, but with some unique features.
One of the most important things is that Game Guardian runs on x64 and x86 devices, which means that you can use it in emulators (NOX, Bluestacks, Andy, Genymotion, Droid4X…) or various devices, without worrying about compatibility.
It requires Android v.2.3.3(Gingerbread) or newer.
Before we start with basic tutorial, it will be nice if we mention some most noteworthy features that would be important to us.
Specific thing about cheating games on mobile devices is that developers usually try to encrypt everything, from memory values, savegames stored on the device, and even data sent over network. Opposite to PC games, where most of the things are not encrypted. The main reason for this are micro-transactions implemented in mobile games, where you have to pay for additional stuff – diamonds, gems, energy…
Game Guardian in most cases successfully finds and changes encrypted values, because it supports XOR, which is often used to protect in-game values.
In addition, it also supports speedhack(game acceleration and deceleration), and even “time jump”, which allow player to jump to exact moment in future.
This is only surface; Game Guardian also supports more unique and useful features, which you can check on Game Guardian official website (LINK).
From the same website you can download newest versions of Game Guardian, and also donate so the project can continue.

NOTE!

Game Guardian requires rooted device in order to work. If you need help about that, see tutorials on this link (XDA-Dev).

Shadow Fight 2 cheat

First of all, download and install GGuardian on your rooted device or emulator (LINK).
After you start it, grant if root access. In the upper right corner of the screen, you should see GGuardian icon.
Open Shadow Fight 2, write somewhere value that you want to change, and click on GGuardian icon.

Game Guardian will ask you which process you want to choose. Choose Shadow Fight 2.

After you selected process, do the following steps. First, click on the last icon in upper right corner, and click on Known (exact) search.

You will see the main window for searching. As value insert the number that you want to change. In our case, it was number of gems on the first picture, 9. Type is DWORD, and you have to click on “The value is encrypted“. After everything is done, click on New search.

Spend some gems, or earn one by watching promo videos, and then search for new value. You have to repeat the same steps, but instead of clicking on New search, click on Refine. Repeat the same procedure until only one value is left. Click on it, and change it.

If you change it to 0, you will get maximum number of gems. If you change it to 4.294.967.295, you will get 0 gems. So choose one number between, or just put 0.
If you have done every step correctly, your game will look like this.

And this is the end of story. Shadow Fight 2 cheat is working. Repeat the same procedure for EXP and GOLD.

Happy cheating!

[pajser]

Game Guardian group search

BY GAMECHEETAH.ORG · MAY 29, 2017

In previous article from this series, we learned basics on how to use Game Guardian to change known values [LINK].
This method is useful when we are dealing with values that can be changed, so we can refine our search multiple times, until we find the right address. In many cases, you will need to find values that can’t be changed from the game (ex. prices from the in-game shop), or to find two or more similar values faster (health and mana).
In this tutorial you will find out how to use Game Guardian group search.
But first, let us explain what exactly is group search. All data from some game are stored in memory when game is started, and every in-game value is stored in different address. If you used Game Guardian, Cheat Engine, or any similar program, you maybe noticed that there is usually hundreds millions unique addresses occupied by the same game.
All addresses are marked with unique code (ex. 9D786251 or 895D2314).
When we scan for only one value, Game Guardian will search through all addresses and save the ones that stores wanted value. On repeated search with different value, it will search through saved list, and make smaller list that contain only changed values that stores new wanted value.

Game Guardian group search

When we do Game Guardian group search, we are searching for two or more values that are close to each other. All addresses are marked with unique hexadecimal number.
The reason behind this is that hexadecimal system is more suitable for computer systems, because each digit (from 0 to F) represent 4 bits. So one byte (8bits), let’s say 00000000 in binary, can be written as 00 in hexadecimal. Biggest value that can be stored in one byte is 11111111 binary, or FF in hexadecimal. If you want to know more about this, please read this article [LINK] on Wikipedia, as you will need to understand this if you want do use Game Guardian for something more advanced.

Basic syntax for group search is “VALUE1;VALUE2;VALUE2:RANGE“, without quotes. You need 2 values minimum, and you don’t need to define RANGE explicitly. If you don’t define range, Game Guardian will define it as 512.
This can be difficult to understand, but let us see the example.

Game Guardian group search examples

Here we will imagine that this values are stored in some addresses.

8D7C6B00 12

8D7C6B01 13

8D7C6B02 14

8D7C6B03 15

8D7C6B04 16

8D7C6B05 17

8D7C6B06 18

 

So we want to find the addresses that contains values 13, 15 and 16, we can use this line.
13;15;16:500

Game Guardian will search all addresses that contain values 13, 15 and 16, and there are up to 500 addresses between them. There is probably a lot of addresses that contains 13,15 and 16, and which are close to each other. In most cases, you will search similar values (gold and silver, or price and product) , so they will be close to each other.
We could do the same search again, with smaller range. If we run this query, 13;15;16:5, we will find our values too, but with less false positives. It will search all values 13,15 and 16 that are up to 5 addresses from each other. It will drastically narrow our search.

Game Guardian ordered group search

There is one similar search, ordered group search. Syntax is almost the same, except the range is defined with mark “::“ , without quotes.
We could use this search if we are sure that numbers are in exact order as we typed in.
In the upper example, 15;13;16:5, 16;13;15:5, 16;15;13:5, 13;16;15:5 will find the same addresses (8D7C6B01, 8D7C6B3, 8D7C6B4).
But if we search for 15;13;16::5, it wont find anything, because the values are not in the right order. But if we search for 13;15;16::5, it will show us right addresses.
Let’s see how this looks like in practice. This is screenshot from the game SimCity BuildIt.

Note how some values occupies more space. Remember what we learned about value types in last tutorial [LINK]!! 

Now, we will see how to use this knowledge in practice.

Using group search for cheating SimCity BuildIt

As we already show in this article [LINK], cheating SimCity BuildIt is really easy with group search. Now we will only show how to cheat on the achievements screen, as we do not need to use incremental change (we will cover this latter).
In SimCitz, go to the achievement screen. Choose one of the achievements – in video there is one where you need to have 1500000 Sims living in your city to get 32 Simoleans. Make DWORD union search – 1500000;32. You will find only two addresses. Edit the 1500000 to 1 and 32 to, let’s say, 10000.  Now claim your hard earned 10000 Simoleans.

And this is all for now. In next tutorial, we will expand this knowledge with incremental editing the value – this will allow us to refine results, even if we can’t change values directly from the game.

[geribaldi]

Gread guide, easy to unterstand!

[Enyby]

Game Guardian fuzzy search and dealing with encryption

by Gamecheetah.org · Published May 31, 2017 · Updated May 31, 2017

 

Assuming that you learned lessons from previous Game Guardian tutorials [Game Guardian beginner tutorial] and [Game Guardian group search tutorial], today we will continue with our Game Guardian tutorial series.
From this article, you will learn basics of Game Guardian fuzzy search. Article will have two main parts – using Game Guardian fuzzy search for finding unknown, unencrypted values, and using fuzzy search for dealing with encrypted values.
But, what is Game Guardian fuzzy search?
It is type of scan where the starting value is unknown – maybe wanted value isn’t visible, or the value is encrypted.
The best example of unknown value is health bar in games – value is usually unencrypted, but instead of number, you only see red bar. We know that there is some number behind red bar. So let’s see how to change unknown value.

Game Guardian fuzzy search

This type of scan is fairly easy if you know the basics.

• Open Game Guardian dashboard, select process from the wanted game, and click on Unknown (fuzzy) search. When you click on it, it will map all in-game values.
• Now, go back to game, and loose some health. Open Game Guardian, and click on Decreased button. It will go through all values again, filtering the ones that have decreased.
• Go back to game, and loose some more. Again, open GG and click on Decreased.
• Game Guardian have one unique feature that isn’t presented in other software of this kind. It can search for unchanged value multiple time. Don’t loose or gain health in game. Open Game Guardian, and choose Unchanged. It will ask you how many scans you want to run. Choose 4-5 times, it will be enough.NOTE! Do not run this right after the first step. Sometimes there will be hundreds of million addresses in the list, and if you run 15 or so Unchanged values scan, it will take forever to finish!
• If there is many addresses left, gain or loose some health, and do increased or decreased search.
• When only one or two addresses are left in the list, change them, or better, just freeze them. If you freeze the value, you won’t loose health anymore.

Using fuzzy search for encrypted values

The main difference between upper example and this one is that we don’t know if the value is increased or decreased. Because developers maybe implemented some shady algorithm to hide the real numbers from the players.
Most trivial example is multiplying value with some number. If you have 100 diamonds, it can be stored in memory as Value*8., or 800. If you earn 20 diamonds, new memory value will be 960. Fairly easy, right? You can still use increased or decreased to find the right value and edit it. But look at the following example.
If some evil developer choose to store 100 diamonds as Value*(-8), then in-game value will be -800. If you earn 20 more, it will be stored as -960. So, if you gain diamonds, in-memory value will decrease, and if you spend some, in-memory value will increase. So we can’t use fuzzy search the same way as we did in the previous example.
All we can do is make first Unknown (fuzzy) search, and find changed/unchanged values.

–Side note–

Of course, there is much better option for dealing with encrypted values in Game Guardian. On Known (exact) search, there is encryption box that can be checked. This is much faster method which you can try first. If it doesn’t work, you can try fuzzy search. You can find example for searching known encrypted value here [Shadow Fight 2 cheat – finding encrypted value in Game Guardian]

In most real life games, you will see even more complex encryption. For example, maybe something like this.
In-memory value = 1083112 + in-game value * (-2048.1) . So the in-memory value will be float number, which can be positive or negative. Almost impossible to find, right? Let’s try it on real game.
In this video (not made by gamecheetah.org) you can see how to use Game Guardian fuzzy search to find encrypted values in Eternium: Mage and Minions.

 

[pajser]

2 hours ago, geribaldi said:

Gread guide, easy to unterstand!

Thank you. I'm trying to make complete GameGuardian tutorial, because current ones are good, but fragmented over many topics, so they are little difficult to find.
If I have written something wrong (I'm fairly new in GameGuardian, so there are probably many features and shortcuts that I have missed), or something has to be corrected, please send me a note.
Of course, any suggestions are appreciated.

[geribaldi]

On 6/1/2017 at 8:47 AM, pajser said:

Thank you. I'm trying to make complete GameGuardian tutorial, because current ones are good, but fragmented over many topics, so they are little difficult to find.
If I have written something wrong (I'm fairly new in GameGuardian, so there are probably many features and shortcuts that I have missed), or something has to be corrected, please send me a note.
Of course, any suggestions are appreciated.

 

This is exactly what we really need. We have the most powerful hacking app on the android market and a insane talented programmer enyby who spent a big part of his lifetime into this project. I know a lot good coders, hackers and skilled modders but there are only a few where i can say "this guy life for high quality work" no bad code, no copy paste stuff....nerver "half work jobs"

 

Without enyby we would have a standard memory editor without a big difference to other tools. 

 

As i moved from pc hacking scene to android few years ago i used other tools because of "easy to use" but after i have seen that gameguardian became more and more features, more stable and more, most support for different devices, emulators etc. And last but not least a never ending development, so i went complete to this insane application. 

 

"Play games your way" (i love this sentence since more than 10 years) is unthinkable without gameguardian. But the problem is the power of this tool. Im a pro cheater but we have so much features that i can only use a small part of them. I have not the experience to use them all because i never learned to code. And 90% of our members have the same problem. We want to hack, we have biggest tool ever, but nobody know how to use.

 

Its like we have a very big p*e*n*i*s and want to fu*ck a girl but we can only do it a little bit because we dont know how to use it rightly ????

 

And thats why i give you and guys like @NoFear a very big thank for the time you spent to make guides for us "noobs" 

 

I know that's a unthankable job but you can be sure there are a lot cheaters like me what see the work behind that and im more than thankful because you help a lot with that guides.

 

Your are absolutely welcome here. Please dont care about "isnt easy to find" we give you full support on our forum and we handle that. Maybe with a gameguardian wiki what will be more clear.

 

Thank you sir's!!!

 

 

[NoFear]

2 hours ago, geribaldi said:

 

This is exactly what we really need. We have the most powerful hacking app on the android market and a insane talented programmer enyby who spent a big part of his lifetime into this project. I know a lot good coders, hackers and skilled modders but there are only a few where i can say "this guy life for high quality work" no bad code, no copy paste stuff....nerver "half work jobs"

 

Without enyby we would have a standard memory editor without a big difference to other tools. 

 

As i moved from pc hacking scene to android few years ago i used other tools because of "easy to use" but after i have seen that gameguardian became more and more features, more stable and more, most support for different devices, emulators etc. And last but not least a never ending development, so i went complete to this insane application. 

 

"Play games your way" (i love this sentence since more than 10 years) is unthinkable without gameguardian. But the problem is the power of this tool. Im a pro cheater but we have so much features that i can only use a small part of them. I have not the experience to use them all because i never learned to code. And 90% of our members have the same problem. We want to hack, we have biggest tool ever, but nobody know how to use.

 

Its like we have a very big p*e*n*i*s and want to fu*ck a girl but we can only do it a little bit because we dont know how to use it rightly ??

 

And thats why i give you and guys like @NoFear a very big thank for the time you spent to make guides for us "noobs" 

 

I know that's a unthankable job but you can be sure there are a lot cheaters like me what see the work behind that and im more than thankful because you help a lot with that guides.

 

Your are absolutely welcome here. Please dont care about "isnt easy to find" we give you full support on our forum and we handle that. Maybe with a gameguardian wiki what will be more clear.

 

Thank you sir's!!!

 

 

I would love to help create a guide on many features in GG and how to use them. It would take a really long time. Figure, the many games I've hacked, I've utilized a huge portion of features Enyby keeps adding. 

"play games your way"

This is exactly what GG provides.

I used to use sbgamehacker which was a great tool. Enyby hasn't stopped developing GG and now has the best memory hacking app. 

 

 

[pajser]

Bypassing XOR encryption in mobile games with Game Guardian

 

In the last few months we noticed increased number of mobile games that uses some sort of encryption. Some of them are simple, like multiplying value with some random number (example: let’s say random number is 8 – in that case, 10 gold in our in-game inventory will be stored as 80 in memory). This simple kinds of encryption can’t trick anyone. But XOR encryption is different story. It is one of the simplest encryption methods, but in most cases it can’t be broken (if data and key have the same length). It is often used as a part in more advanced ciphers. But we will cover this latter.
There are lot of tutorials that teach us how to bypass XOR encryption in mobile games, but most of them don’t show us process that lies behind. So before we start, we need to read some theory about the subject. If you learn this, you will be able to bypass XOR encryption with only basic memory editor, paper and pen.
Of course, this is some sort of advanced tutorial – we assume that you are at least familiar with basics of memory editing.

Cryptography 101 (logic for dummies)

In the beginning, there was Boolean algebra. For those who haven’t overslept math and logic classes, you can skip this chapter. If you have overslept, read carefully.
George Boole was mathematician, logician and philosopher who published his most famous notes in the middle of the 19th century. You probably asked yourself why are you reading about some dude who lived 100 years before ENIAC. This dude is father of all computers – every digital circuit on our planet works on his principles.

For our story, it is important to notice that every algebra has own values and operations. Imagine that, in some sort of simple algebra, values are set of natural numbers from 1 to 10 [1,2,3,4,5,6,7,8,9], and only operations are addition(+), subtraction(-), multiplication(*), and division(/). From our knowledge of elementary algebra (math from school), you can tell that 1+1 =2, or 2*4=8.

While elementary algebra deals with numbers, Boolean algebra use only two values – TRUEand FALSE. They are represented as 1(true) and 0(false). All operations are done on this two values. Of course, you can’t preform multiplication or subtraction on this values. We need some other operations that can be preformed on TRUE and FALSE. These operations are called bitwise operations. There are three basic operations in Boolean algebra – NOT(¬), AND (∧) and OR (∨), and they are really simple to understand. Take a look at this image, and everything will be clear.

Source: Wikipedia

Just kidding, forget this and let’s move on.

Basic bitwise operations

I know this will maybe be hard to understand, especially if this is your first time you read about logic. So I will try to make it simple. Boolean algebra (and any other logic) are made to teach us how to make correct conclusions.
In elementary algebra, correct conclusion is when we write that 1+1=2. As we said, in Boolean algebra there are only two values, and we can only preform operations on them.

Now imagine that we have a few true or false statements:

• Tom is a cat (TRUE or 1)
• Jerry is a mouse (TRUE or 1)
• Sky is green (FALSE or 0)
  

NOT operator

This is fairly simple examples. Let’s see our first operator, NOT(¬). “Tom in not a cat”, is this statement true or false? Of course, it is FALSE.
Jerry is not a mouse = FALSE or 0.
Sky is not green = TRUE or 1.

This operator preforms logical negation on a given statement. 0 become 1, and 1 become 0. We can write it like this:

• ¬0 = 1
• ¬1 = 0

AND operator

AND(∧) operator takes two arguments, and returns TRUE only if both arguments are TRUE. Tom is a cat AND Jerry is a mouse = TRUE(1). Tom is a cat AND Sky is green = FALSE(0).
You can easily remember this operator – just multiply two arguments and you have correct result. 
We can write it like this:

• 1 ∧ 1 = 1
• 1 ∧ 0 = 0
• 0 ∧ 1 = 0
• 0 ∧ 0 = 0

OR operator

OR (∨) operator takes two arguments, and return FALSE only if both of the statements are FALSE. In every other case it returns TRUE.
Tom is car OR Sky is green = TRUE(1). Sky is green OR Sky is red = FALSE(0). 

• 1 ∨ 1 = 1
• 1 ∨ 0 = 1
• 0 ∨ 1 = 1
• 0 ∨ 0 = 0

Maybe you wonder why are we talking about Tom and Jerry. In computer world, everything is made in binary system. There are only two states in computer – there is current flow (1) and there isn’t current flow (0). So every information is stored in binary numeral system. Each digit (0 or 1) is called bit. Group of 8 bits are called byte. Any information can be translated into binary system.
So our “tom” will be 01110100 01101111 01101101 in binary, and “sky” will be 01110011 01101011 01111001. Guess what? You can preform this bitwise operations on binary values.
So, “tom” OR “sky”?

    01110100 01101111 01101101 tom

∨ 01110011 01101011 01111001 sky

____________________________

   01110111 01101111 01111101 wo}

If we want preform AND operator, this will be result:

    01110100 01101111 01101101 tom

∧ 01110011 01101011 01111001 sky

_______________________________

    01110000 01101011 01101001 pki

Well, this was not very useful. But it is important to remember this, because now you will learn another bitwise operation – exclusive disjunction (exclusive OR, known as XOR).

XOR (exclusive OR) bitwise operator

I hope you understand these basic bitwise operators. There is also so-called “secondary operators or operations”, which can be derived from basic operators. One of these secondary operators is XOR, or exclusive OR. You will understand why is it called “exclusive OR” when you see the following table.

• 1 XOR 1 = 0
• 1 XOR 0 = 1
• 0 XOR 1 = 1
• 0 XOR 0 = 0

As you can see, if you perform XOR operation on two different values, it will return 1 or true. If values are the same, it will return 0 or false. So what is the catch?
Why are XOR so special, and why is it used in cryptography? Now, look again our previous example, and you will see. From now on, we will preform XOR operation on original data (“tom” in our case) with the key (“sky” in our case).

         01110100 01101111 01101101 tom

XOR 01110011 01101011 01111001 sky

_____________________________________

         00000111 00000100 00010100 //this can't be converted to meaningful text

But what will happen if we XOR out new value (00000111 00000100 00010100) with the same key (sky or 01110011 01101011 01111001)?
Let’s try it.

         00000111 00000100 00010100

XOR 01110011 01101011 01111001 sky

___________________________________

         01110100 01101111 01101101 tom

Right, we got our original data. But there is more -what if we don’t know the key (“sky”)

         01110100 01101111 01101101 tom

XOR 00000111 00000100 00010100

___________________________________

         01110011 01101011 01111001 sky

We have out original key. This is the reason why XOR operator is special. We can’t achieve this with other operators.

XOR encryption in mobile games

So let’s see some real world example – using XOR encryption in mobile games. Imagine that you have 1000 gold in some game. Developers implemented that all values are XOR-ed with the key 1337, and stored in memory. So look at the example. For conversion for decimal to binary you can use Windows calculator, or some online tools [BINARY TO DECIMAL CONVERTER]

         0000001111101000 1000

XOR 0000010100111001 1337

_________________________

         0000011011010001 1745

This means that “1000” gold is stored as “1745” in memory. If you earn more gold (let’s say you got 1050 gold now), it will be stored in memory like this.

         0000010000011010 1050

XOR 0000010100111001 1337

_________________________

         0000000100100011 291

So how we can bypass this sort of encryption?

Bypassing XOR encryption with Game Guardian

We already saw that:

• original value XOR key = encrypted value
• encrypted value XOR key = original value
• original value XOR encrypted value = key

With this principle, we can bypass XOR encryption even if we don’t know that key developers used. So let’s start with practical work. If you aren’t familiar with fuzzy search, it will be useful to first read this tutorial [GAME GUARDIAN FUZZY SEARCH TUTORIAL].

We are going to use examples from previous paragraph. Our first step is to find address where the encrypted value is stored.
This step is simple. First, scan for unknown starting value – this is done by selecting Fuzzy search from Game Guardian. As value type, you can choose DWORD (it was DWORD in all games that we cheated). Change the amount of gold in-game, then search for changed value. Repeat this step until only one address has left on the list.

Now it is time to check if XOR encryption is used. Let’s say you got 1000 gold in game, but with fuzzy search you found value 1745.
Preform XOR operation on this two values.

         0000001111101000 1000 //Ingame gold

XOR 0000011011010001 1745 //Value that you have found with fuzzy search

_________________________

         0000010100111001 1337 //Key? --write it down

Now change original value – earn or spend some gold. Let’s say you have 1050 gold now. Look at the address that you found with fuzzy search, and read the value.
Again, preform XOR operation with in-game value and in-memory value.

         0000010000011010 1050 //In-game value

XOR 0000000100100011 291 //Value which is stored in memory

_________________________

         0000010100111001 1337 //KEY!!

If two keys are the same, XOR encryption is used and you have found the key. If they are not, XOR encryption is not used.
Now, let’s change our gold (it was our primary goal, right?). We want 9999 gold. Again, preform XOR operation on it with key that you found (1337 in our case).

         0010011100001111 9999

XOR 0000010100111001 1337

___________________________

         0010001000110110 8758

 

Change the value that you found with fuzzy search – as new value set 8758. Open game again, and you should have 9999 gold. You can now cheat game using paper and pen, as we promised on the beginning. But it would be smarter if you use XOR calculator built in Game Guardian 

Second method to bypass XOR encryption

Now, you will see the true power of Game Guardian. For this method, it is important to note that in most games, encrypted value and key are stored next to each other in memory – for DWORD type,one value occupies 4 bytes,so the key is usually 4 bytes away from encrypted value. Look at this picture.

In Game Guardian, there is builtin method which automatically search for values, and XOR them with value which is X bytes away.
That means that we don’t need to do fuzzy search, or calculate XOR values. Game Guardian can do it for us. Let’s get back to our previous example and imagine that encrypted value and key are 4 bytes away.

• If you have 1000 gold in-game, click on Known search, as type choose Dword (it can be some other types too, but it is usually dword.). As value, put in 1000X4, and click on search. In this example, first number “1000” is amount of currency that we want to change.
  Second part, “X4“, marks how many bytes away is the key. For dword values it can be X4,X8, X12, X16…
• Earn or spend some currency – let’s say that you have 900 gold now. Now input 900X4, and click on refine.
• Repeat previous step until you have only one address left (or few addresses if you want).
• Click on Edit, and as a value input 9999X4.

And that’s it. Game Guardian will automatically search for encrypted values, and XOR them with key which is X bytes away. Pretty impressive feature.

With this, our tutorial has finished. There will be reference links bellow, if you want to know more about this subject.
Any suggestions are appreciated. Happy cheating.

Reference links

[Algebraic operation – Wikipedia article]
[Binary numbers]
[Boolean algebra]
[Exclusive OR – XOR, Wikipedia]
[NoFear’s tutorial – Xor search guide]
[Binary to decimal online calculator]

[NoFear]

@pajser

Nice write up! 

I might've missed this or it wasnt mentioned, games with rotating xor key... Essentially was "near impossible", excessive amount of unknown searches and checking pairs in results for proper xor value.  The addition of the xor search in GG is so amazing. 

Thank you for the detailed information on XOR. 

[pajser]

Tnx, your tutorial inspired me for writing this. 
Yep, I didn't mentioned it. I heard that there is games that change XOR key when the value change, but I didn't find any. 
Do you have any examples maybe?

[Enyby]

53 minutes ago, pajser said:

with key which is X bytes away.

As key assumed always first value. As value - second. Then key placed always before value.

In most cases this is does not matter, because order of XOR do not change result.

_______________________________________________

added 4 minutes later

And we recently added a new function Calculate XOR, which helps to quickly calculate XOR between any two values.

[pajser]

Tnx for correction. English isn't my first language, so I tried to said that key is 4 bytes "daleko" from value.
I will try to find more suitable word. 

[shinobi97]

Nice very useful

[Zaidos]

@pajser Concerning the screenshot and details on the subsection:

12 hours ago, pajser said:

Second method to bypass XOR encryption

Now, you will see the true power of Game Guardian. For this method, it is important to note that in most games, encrypted value and key are stored next to each other in memory – for DWORD type,one value occupies 4 bytes,so the key is usually 4 bytes away from encrypted value. Look at this picture.

Isn't the KEY supposed to be first and Encrypted Value second?